HackTheBox - Hathor

00:00 - Intro 00:50 - Start of nmap 04:00 - Navigating to the page 05:00 - Discovering the forgot password feature enables people to enumerate valid users 06:45 - Finding the default credentials for mojo portal and then logging in as admin 07:50 - Uploading an ASPX Webshell but finding out the aspx extension is blacklisted 10:30 - Looking at the GitHub issues for MojoPortal 12:00 - Copying a file to bypass the bad extension filter of uploaded material and getting our webshell 12:50 - Showing the importance of redirecting STDERR to STDOUT on web shells to discover why some commands fail 15:00 - Failing to run a Powershell Reverse Shell bypassing AV, only to find out it is in ConstrainedLanguage Mode 18:30 - Attempting to upload netcat to find out its blocked via group policy 20:30 - Enumerating Applocker with Powershell Get-AppLockerPolicy -Effective -xml 26:50 - Looking at the Get-BadPasswords directory, finding an NTLM Hash 31:30 - Logging into the box via kerberos bec